CVE-2021-32796: xmldom project xmldom

csirt@kutim:~/threat-intel/cve/CVE-2021-32796

CVSS 5.3 · Medium EPSS 1,4%

Kerentanan Improper Encoding or Escaping of Output pada xmldom project xmldom. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

xmldom is an open source pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. xmldom versions 0.6.0 and older do not correctly escape special characters when serializing elements removed from their ancestor. This may lead to unexpected syntactic changes during XML processing in some downstream applications. This issue has been resolved in version 0.7.0. As a workaround downstream applications can validate the input and reject the maliciously crafted documents.

Rincian

Terbit di NVD: 27 Juli 2021
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-116: Improper Encoding or Escaping of Output
CWE-91: XML Injection (aka Blind XPath Injection)
EPSS (30 hari): 1,4% peluang dieksploitasi; lebih tinggi dari 70,9% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
xmldom project	xmldom	Semua versi sebelum 0.7.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/xmldom/xmldom/commit/7b4b743917a892d407356e055b296dcd6d107e8b patch · advisory pihak ketiga
https://github.com/xmldom/xmldom/security/advisories/GHSA-5fg8-2547-mr8q advisory pihak ketiga
https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities/ not applicable · advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.